Elekto MCP for SQL Server

Elekto.Mcp.Sql

Read-only MCP server for SQL Server 2017+ introspection and querying (tested on 2019 and 2022). Exposes schema metadata, object definitions, and data queries via the MCP protocol (stdio), allowing GitHub Copilot (and other MCP clients, like Claude, etc.) to understand your database structure without storing credentials in the repository.

⚠️ Privacy and Data Security Warning

MCP servers act as a bridge between your local data and AI language models. When you use this server with an AI assistant (such as GitHub Copilot, Claude, or others), the following happens:

1. The AI agent calls tools on this server to read data from your SQL Server database.
2. The results — which may include table schemas, stored procedure definitions, or actual row data — are sent back to the AI agent and transmitted to the LLM provider's infrastructure for analysis.
3. This means your data leaves your machine and is sent to a third-party service (Microsoft, Anthropic, OpenAI, etc.), subject to their respective terms of service and privacy policies.

Before connecting this server to any database, carefully consider:

• What data could be read? Does it include PII, financial records, trade secrets, or other sensitive information?
• Who is the LLM provider and what are their data retention and privacy policies?
• Are you authorized to share this data with that third party under applicable laws and regulations?

Recommendations:

• Never connect to databases containing sensitive data unless you have explicitly assessed and accepted this risk.
• Use database accounts with the minimum required privileges (read-only, restricted to specific schemas where possible).
• Use max_query_rows to limit how much data can be returned in a single call.
• Prefer databases with anonymized or synthetic data for development and exploration.
• AI agents can be extremely creative in finding ways to execute a task. Altouht this server is designed to be read-only and to validate all inputs, there is always a risk of unintended consequences when exposing database access to an AI agent.

Regardless of the precautions you take, the responsibility for any consequences arising from the use of this tool rests entirely with you. This software is provided *as is* with no warranties of any kind.

Available Tools

Upgrading from 1.x

Version 2.0.0 changes what the tools return and how their parameters are declared. Nothing needs reconfiguring — connection files, .mcp.json and the CLI arguments are unchanged — but anything that parses the output will notice:

Everything else — every other tool, every other field — is unchanged.

What changed in 2.1.0

Nothing changes shape: arrays are still arrays and objects keep every field they had. A few values now say "unknown" instead of passing a guess for a fact, which is worth knowing if you parse them:

What changed in 2.2.0

No tool result changes shape. What changes is how the server starts and how it is packaged:

The process no longer exits with code 1 when the configuration is missing or unreadable. Anything that relied on that exit code should read a tool's answer instead. The README also gained setup instructions for Claude Code and Codex.

What changed in 2.3.0

No tool result changes shape; what changes is what the tools say about themselves, which is what an agent chooses them by:

What changed in 2.3.1

Nothing changes shape. generate_dependency_dot now says which way its arrows point, what it returns besides the DOT text, how to render it and when another tool fits better. The server is listed in the MCP Registry as "Elekto MCP for SQL Server", and each release now also appears under the repository's GitHub Releases.

What changed in 2.3.2

Nothing changes shape. When no connection is configured, the guidance returned to the agent now tells it to agree with the user before writing anything, and never to write a password into the connections file or anywhere else, using %{VARIABLE} in its place. It also points to connections the project may already keep where this server does not look (spring.datasource.url in application.properties or application.yml, or a sqlserver:// or mssql:// URL in a .env file), for the agent to show the user rather than for the server to parse.

What changed in 2.3.3

Nothing changes shape. The tool shipped System.Security.Cryptography.Pkcs 9.0.13, which Microsoft.Data.SqlClient brings in and which two .NET denial of service advisories affect: GHSA-846f-f764-76mx (CVE-2026-84008, high) and GHSA-2fmv-rv2c-59x7 (CVE-2026-70162, moderate). It now ships the fixed 10.0.13. Update the global tool with dotnet tool update -g Elekto.Mcp.Sql; a dnx configuration that names no version picks up 2.3.3 by itself.

This is also the first release whose GitHub Release carries the package, with a build provenance attestation; Verifying a release shows how to check it.

What changed in 2.3.4

Nothing changes shape. The tool now runs on `Microsoft.Data.SqlC